Privacy Policy

This website is hosted by Alfahosting GmbH, Edmund-von-Lippmann-Str. 13-15, 06112 Halle (Saale), Germany. When you visit the website, the host processes the data listed under “Server log files” on our behalf. We have concluded a data processing agreement with Alfahosting pursuant to Art. 28 GDPR.

Each time the website is accessed, the server automatically stores:

• IP address,
• date and time of access,
• page accessed and amount of data transferred,
• previously visited page (referrer),
• browser and operating system.

This data is used for secure operation and troubleshooting. The legal basis is Art. 6 (1) (f) GDPR. It is not combined with other data. The IP address is shortened after 24 hours (the last octet is set to zero), and the log files are deleted after 7 days at the latest.

This website uses TLS encryption. You can recognise it by the padlock symbol and “https://” in the address bar.

We set technically necessary cookies without consent (Section 25 (2) TDDDG). These include:

• the cookie that stores your language setting (German/English) (WPML),
• the cookies that store your choice in the consent banner.

All other services (Google Analytics and Meta Pixel) only load once you agree in the banner. You can change or withdraw your consent at any time with effect for the future. Use the “Manage consent” button at the edge of every page.

The banner is run with the WordPress plugin Complianz. It runs on our own server; no data is transferred to the manufacturer.

If you contact us by email, phone or via the contact form on our website, we process your details (name, email address, optionally your phone number, topic, message) to answer your enquiry.

The legal basis is Art. 6 (1) (b) GDPR if your enquiry relates to an order, otherwise Art. 6 (1) (f) GDPR. Data from the form is sent to us by email. You will also receive an automatic confirmation of receipt at the email address you entered. Sending is handled by our email service Microsoft 365 (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland) as a processor pursuant to Art. 28 GDPR. Data may be transferred to the USA; Microsoft is certified under the EU-US Data Privacy Framework. A copy of every email sent by the website is stored on our server for 7 days for troubleshooting and then deleted automatically.

We delete it once your enquiry has been dealt with and no retention obligation applies.

To protect against automated spam, the form contains a simple control question. No data is transferred to third parties.

Application forms (Jotform)

For applications to our vacancies we embed forms provided by Jotform (Jotform Inc., 4 Embarcadero Center, Suite 780, San Francisco, CA 94111, USA). Our account is set up in the EU region. Submitted form data is sent to an EU server of Jotform and stored in a data centre in Frankfurt am Main, Germany.

When the form loads, your IP address and technical information about your browser are transferred to Jotform and its content delivery network.

We have concluded a data processing agreement with Jotform. For any transfer to the USA we rely on the EU-US Data Privacy Framework, under which Jotform is certified.

Purpose, legal basis, retention period

We process your application data to decide on establishing an employment relationship (Section 26 BDSG, Art. 6 (1) (b) GDPR). Only the people involved in the selection process have access.

If you are not hired, we delete your data no later than six months after the end of the process (period for possible claims under the German General Equal Treatment Act), unless you have consented to longer storage. If you are hired, the data is transferred to your personnel file.

With your consent we use Google Analytics, integrated via the WordPress plugin Site Kit. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics records how visitors use the website (e.g. pages viewed, time spent, approximate location, device and browser) and sets cookies for this purpose. Your IP address is shortened by Google within the EU. We use the reports to improve the website.

The legal basis is your consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG). Without consent, Google Analytics is not loaded.

Data may be transferred to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework. Google’s data processing terms apply to the processing (processing on behalf pursuant to Art. 28 GDPR).

Event data (e.g. individual page views) is deleted after 2 months, user-related data after 14 months.

We have activated “Google signals”. If you are signed in to your Google account and have allowed personalised advertising there, Google can combine your use of our website across devices. We only receive aggregated statistics, no information about individual people. You can switch this off in your Google account under “My Ad Center”.

With your consent we use the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

The pixel determines whether visitors came to us via an ad on Facebook or Instagram and whether they then, for example, submitted an application. This lets us measure the success of our ads and show ads to people who are interested in our company. Meta may link this data to your Facebook or Instagram account and use it for its own purposes.

We are jointly responsible with Meta for collecting the data and transferring it to Meta (Art. 26 GDPR). You can find the agreement here at Meta. Meta alone is responsible for any further processing. More information in Meta's privacy policy.

The legal basis is your consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG). Data may be transferred to Meta Platforms Inc. in the USA; Meta is certified under the EU-US Data Privacy Framework.

To protect the login area against attacks, the plugin “Limit Login Attempts Reloaded” stores the IP address in the event of failed login attempts and blocks it temporarily. The legal basis is Art. 6 (1) (f) GDPR. The data is stored on our server. Failed attempts are reset after 24 hours, and a block lasts no longer than 24 hours.

Links

Our website links to our pages on Facebook and Instagram. These are simple links: data is only transferred when you click the link and open the provider’s page.

Our pages on Facebook and Instagram

We are jointly responsible with Meta for our company pages on Facebook and Instagram insofar as Meta provides us with statistics on the use of these pages (Art. 26 GDPR). You can find the agreement here at Meta. You can also assert your rights directly with Meta.

You have the right to:

• access to the data we store about you (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• withdraw your consent with effect for the future (Art. 7 (3) GDPR).

Right to object (Art. 21 GDPR): If we process your data on the basis of a legitimate interest, you can object at any time on grounds relating to your particular situation.

To exercise your rights, contact info@schurig-int.de or the address above.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information), Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

We update this privacy policy when the website or the legal situation changes. The version published here applies.